github-search
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's description uses the keyword 'CRITICAL:', which is a common pattern used in prompt injection to force the agent to prioritize certain instructions or bypass safety filters.
- [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to search for and install external repositories from GitHub, creating a surface for indirect prompt injection attacks.
- Ingestion points: Repository metadata and content retrieved from GitHub via the 'cowork search' command in the SKILL.md file.
- Boundary markers: None. The instructions do not include delimiters or warnings to the agent regarding potential instructions within the fetched repository data.
- Capability inventory: The skill uses 'cowork generate' and 'cowork install' (referenced in SKILL.md), which can execute or integrate new instructions from untrusted sources into the agent's context.
- Sanitization: There is no evidence of validation or sanitization of the content fetched from GitHub before it is processed or installed.
Audit Metadata